Analysis
-
max time kernel
151s -
max time network
155s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
02-02-2024 12:52
Static task
static1
Behavioral task
behavioral1
Sample
898f0ec3d9588199aa00da724447b5bb.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
898f0ec3d9588199aa00da724447b5bb.exe
Resource
win10v2004-20231222-en
General
-
Target
898f0ec3d9588199aa00da724447b5bb.exe
-
Size
2.1MB
-
MD5
898f0ec3d9588199aa00da724447b5bb
-
SHA1
0a5a6aa8a1e8fb83b71516d9086d899836410ba2
-
SHA256
e139a350242af220a379940c1a667891161ff92bdcdbb5acd024076a27ddbf56
-
SHA512
ff309a380ec33837425f4eaf64de9dbdf1f2446024e93a2ca67bc3b5749c8f417be82e1043858cd45a614d14b3d84fb67537457067e6fb95154dae0271d6fb09
-
SSDEEP
49152:QfQtjoZLBU0ZId3qgF6TuWrYWjvGyh8iw:Qf4oZ3INqgUT1rYWjuy
Malware Config
Extracted
bitrat
1.38
45.153.241.244:5506
-
communication_password
fcea920f7412b5da7be0cf42b8c93759
-
install_dir
esb6asg
-
install_file
wsd.exe
-
tor_process
tor
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
898f0ec3d9588199aa00da724447b5bb.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\wsd = "C:\\Users\\Admin\\AppData\\Local\\esb6asg\\wsd.exe" 898f0ec3d9588199aa00da724447b5bb.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
Processes:
898f0ec3d9588199aa00da724447b5bb.exepid process 312 898f0ec3d9588199aa00da724447b5bb.exe 312 898f0ec3d9588199aa00da724447b5bb.exe 312 898f0ec3d9588199aa00da724447b5bb.exe 312 898f0ec3d9588199aa00da724447b5bb.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
898f0ec3d9588199aa00da724447b5bb.exedescription pid process target process PID 2256 set thread context of 312 2256 898f0ec3d9588199aa00da724447b5bb.exe 898f0ec3d9588199aa00da724447b5bb.exe -
Suspicious behavior: RenamesItself 29 IoCs
Processes:
898f0ec3d9588199aa00da724447b5bb.exepid process 312 898f0ec3d9588199aa00da724447b5bb.exe 312 898f0ec3d9588199aa00da724447b5bb.exe 312 898f0ec3d9588199aa00da724447b5bb.exe 312 898f0ec3d9588199aa00da724447b5bb.exe 312 898f0ec3d9588199aa00da724447b5bb.exe 312 898f0ec3d9588199aa00da724447b5bb.exe 312 898f0ec3d9588199aa00da724447b5bb.exe 312 898f0ec3d9588199aa00da724447b5bb.exe 312 898f0ec3d9588199aa00da724447b5bb.exe 312 898f0ec3d9588199aa00da724447b5bb.exe 312 898f0ec3d9588199aa00da724447b5bb.exe 312 898f0ec3d9588199aa00da724447b5bb.exe 312 898f0ec3d9588199aa00da724447b5bb.exe 312 898f0ec3d9588199aa00da724447b5bb.exe 312 898f0ec3d9588199aa00da724447b5bb.exe 312 898f0ec3d9588199aa00da724447b5bb.exe 312 898f0ec3d9588199aa00da724447b5bb.exe 312 898f0ec3d9588199aa00da724447b5bb.exe 312 898f0ec3d9588199aa00da724447b5bb.exe 312 898f0ec3d9588199aa00da724447b5bb.exe 312 898f0ec3d9588199aa00da724447b5bb.exe 312 898f0ec3d9588199aa00da724447b5bb.exe 312 898f0ec3d9588199aa00da724447b5bb.exe 312 898f0ec3d9588199aa00da724447b5bb.exe 312 898f0ec3d9588199aa00da724447b5bb.exe 312 898f0ec3d9588199aa00da724447b5bb.exe 312 898f0ec3d9588199aa00da724447b5bb.exe 312 898f0ec3d9588199aa00da724447b5bb.exe 312 898f0ec3d9588199aa00da724447b5bb.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
898f0ec3d9588199aa00da724447b5bb.exedescription pid process Token: SeDebugPrivilege 312 898f0ec3d9588199aa00da724447b5bb.exe Token: SeShutdownPrivilege 312 898f0ec3d9588199aa00da724447b5bb.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
898f0ec3d9588199aa00da724447b5bb.exepid process 312 898f0ec3d9588199aa00da724447b5bb.exe 312 898f0ec3d9588199aa00da724447b5bb.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
898f0ec3d9588199aa00da724447b5bb.exedescription pid process target process PID 2256 wrote to memory of 312 2256 898f0ec3d9588199aa00da724447b5bb.exe 898f0ec3d9588199aa00da724447b5bb.exe PID 2256 wrote to memory of 312 2256 898f0ec3d9588199aa00da724447b5bb.exe 898f0ec3d9588199aa00da724447b5bb.exe PID 2256 wrote to memory of 312 2256 898f0ec3d9588199aa00da724447b5bb.exe 898f0ec3d9588199aa00da724447b5bb.exe PID 2256 wrote to memory of 312 2256 898f0ec3d9588199aa00da724447b5bb.exe 898f0ec3d9588199aa00da724447b5bb.exe PID 2256 wrote to memory of 312 2256 898f0ec3d9588199aa00da724447b5bb.exe 898f0ec3d9588199aa00da724447b5bb.exe PID 2256 wrote to memory of 312 2256 898f0ec3d9588199aa00da724447b5bb.exe 898f0ec3d9588199aa00da724447b5bb.exe PID 2256 wrote to memory of 312 2256 898f0ec3d9588199aa00da724447b5bb.exe 898f0ec3d9588199aa00da724447b5bb.exe PID 2256 wrote to memory of 312 2256 898f0ec3d9588199aa00da724447b5bb.exe 898f0ec3d9588199aa00da724447b5bb.exe PID 2256 wrote to memory of 312 2256 898f0ec3d9588199aa00da724447b5bb.exe 898f0ec3d9588199aa00da724447b5bb.exe PID 2256 wrote to memory of 312 2256 898f0ec3d9588199aa00da724447b5bb.exe 898f0ec3d9588199aa00da724447b5bb.exe PID 2256 wrote to memory of 312 2256 898f0ec3d9588199aa00da724447b5bb.exe 898f0ec3d9588199aa00da724447b5bb.exe PID 2256 wrote to memory of 312 2256 898f0ec3d9588199aa00da724447b5bb.exe 898f0ec3d9588199aa00da724447b5bb.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\898f0ec3d9588199aa00da724447b5bb.exe"C:\Users\Admin\AppData\Local\Temp\898f0ec3d9588199aa00da724447b5bb.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\898f0ec3d9588199aa00da724447b5bb.exe"C:\Users\Admin\AppData\Local\Temp\898f0ec3d9588199aa00da724447b5bb.exe"2⤵
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/312-26-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/312-9-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/312-49-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/312-48-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/312-5-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/312-28-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/312-8-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/312-27-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/312-10-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/312-11-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/312-13-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/312-14-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/312-15-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/312-17-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/312-19-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/312-18-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/312-20-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/312-22-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/312-23-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/312-24-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/312-3-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/312-47-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/312-46-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/312-29-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/312-30-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/312-31-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/312-33-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/312-34-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/312-35-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/312-37-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/312-38-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/312-39-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/312-40-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/312-41-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/312-42-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/312-44-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/312-45-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/2256-7-0x0000000000ED0000-0x00000000010B4000-memory.dmpFilesize
1.9MB
-
memory/2256-1-0x0000000000ED0000-0x00000000010B4000-memory.dmpFilesize
1.9MB
-
memory/2256-0-0x0000000000ED0000-0x00000000010B4000-memory.dmpFilesize
1.9MB
-
memory/2256-2-0x00000000010C0000-0x0000000001485000-memory.dmpFilesize
3.8MB